Technical report on DNC hack [pdf] • Hacker News Board

Re: Technical report on DNC hack [pdf]

#341

Post by codedokode » Fri, Dec 30, 2016, 2:43 AM UTC

ryanlol wrote: post #173

codedokode wrote: post #167

Earlier quoted context omitted.

> The obfuscation used in the russian PHP shells looked awfully familiar I have seen similar obfusaction many times before. Generally most PHP backdoors look like eval($_POST['something']) and here eval is replaced with create_function (by the way I know several other functions that can be used instead of eval). This method of obfuscation (eval + gzip/base64_decode and other functions) is also sometimes used in legit…

>I have seen similar obfusaction many times before. If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typical base64 silliness, and it's certainly very uncommon. This actually uses a cookie to decrypt the encrypted shell before executing it. Pretty obvious, but very few things actually do it.

You are right, I didn't look carefully, this is not simply eval(POST) backdoor, it has a payload and it is encrypted with an external key that is provided via POST or COOKIE; but I see some weak points and will try to guess the key.

Maybe this code is encrypted using some generic obfuscation tool and the file at github matches the rule at report because their payload was encrypted with the same tool?

I'll also add some thoughts under @wongarsu's comment.

Re: Technical report on DNC hack [pdf]

#342

Post by dang » Fri, Dec 30, 2016, 2:43 AM UTC

crabstraggler wrote: post #86

Unfortunately for her, being "robbed like a Christian in the night" doesnt hold a candle of defence to DKIM signatures. Sorry Brazilenut, you gave multiple questions to the Hillary campaign and are guilty of conspiring to destroy the fairness of a democratically held election. Goto jail and dont come back.

We've banned this account for trolling, detached this comment from https://news.ycombinator.com/item?id=13280251, and marked it off-topic.

Please stop creating accounts to break HN's rules with.

Re: Technical report on DNC hack [pdf]

#343

Post by programmarchy » Fri, Dec 30, 2016, 2:46 AM UTC

hourislate wrote: post #247

ww520 wrote: post #199

Earlier quoted context omitted.

The purpose of these "reports" and the retaliation against the Russians is to undermine the legitimacy of the Trump presidency. There's no need for proof, just innuendo and allegation would do. Pretty sick of technology got dragged through the mud for political purpose.

I completely disagree. This isn't about Trump winning. Nobody disputes that. This is about Russia interfering with the US Election and intentionally trying to undermined western society. Russia has launched a War against the US and Europe. Sponsoring Right Wing Groups with millions in cash to Cyber warfare against Government institutions.

I disagree. All signs point to Russia wanting peace with the US, and I think they are cozying up to Trump so he will roll back the sanctions that have been choking the Russian economy since 2014 or so.

Clinton was the one saber rattling against Russia during the election, not Trump. So assuming your theory is Russia hacked the DNC, their motivations seem to be to avoid war, not escalate.

However, there is definitely a cultural war going on within Western civilization between cultural Marxists wanting a global, totalitarian state and libertarian civic nationalists wanting a decentralized, limited state.

Where Russia comes in, and what's really funny about all this, is that the "right" now finds itself aligned with former Soviet communists and the "left" finds itself aligned with the Islamic caliphate. Politics can make strange bedfellows indeed.

Re: Technical report on DNC hack [pdf]

#344

Post by dang » Fri, Dec 30, 2016, 2:48 AM UTC

empath75 wrote: post #330

Not to mention russia has a huge paid operation of trolls out there muddying the water. You see them all over hacker news and Reddit.

If you see evidence of this, you should send it to hn@ycombinator.com so we can investigate. If you don't have evidence, it's unsubstantive to post such a claim—not to mention that interpreting other users' different opinions as shillage is uncivil and against the rules here.

We detached this comment from https://news.ycombinator.com/item?id=13281453 and marked it off-topic.

Re: Technical report on DNC hack [pdf]

#345

Post by dang » Fri, Dec 30, 2016, 2:50 AM UTC

davexunit wrote: post #40

[deleted] wrote: post #34

Earlier quoted context omitted.

[deleted]

Delete your account.

Please don't, regardless of the provocation. It just makes the thread worse.

If you see an egregious comment, flag it instead. (You can flag a comment by clicking on its timestamp to go to its page, then clicking 'flag' at the top. This requires > 30 karma.)

Re: Technical report on DNC hack [pdf]

#346

Post by dang » Fri, Dec 30, 2016, 2:51 AM UTC

catawbasam wrote: post #15

You are assuming the poster lives in a democratic system. They could just as well be a paid bot from an autocratic state.

Insinuating shillage without evidence is not allowed here. An opposing opinion does not count as evidence.

We detached this comment from https://news.ycombinator.com/item?id=13280008 and marked it off-topic.

Re: Technical report on DNC hack [pdf]

#347

Post by bobzibub » Fri, Dec 30, 2016, 2:53 AM UTC

I think that there is a second assumption which is overlooked: Hypothetically, let us assume that the Russians did break in and steal emails etc. Governments do so all the time so it could well be true. Now the question to me is: why would they release all the emails to Wikileaks? The emails seem relatively benign and not very damming of HRC. Why not keep the information in your back pocket until they can be researched and leveraged? Releasing them diminishes their value to an intelligence agency. And why not release selected HRC's (herself) emails? Surely the Russians could have gotten those of they tried. Assuming she's not squeaky clean, they could have released selected individual emails anonymously and ensured a Trump win, plus keep other assets for later. Would a better hypothesis be that US intelligence services saw break-ins and so released the information they knew foreign governments could be used as leverage aagainst a likely future president? This way they immunize against the information's use, plus blame the Russians but the US would dearly like to punish Russia for their victory in Syria anyway. This makes more sense to me but am interested in why this hypothesis is wrong or less likely.

Re: Technical report on DNC hack [pdf]

#348

Post by travmatt » Fri, Dec 30, 2016, 2:54 AM UTC

praxulus wrote: post #307

464192002d7fe1c wrote: post #296

Earlier quoted context omitted.

How is primary rigging fake news? Its very obvious from reading the wiki leaks emails that the DNC was brazenly biased towards Hillary and against Sanders.

Because there's absolutely no evidence that it was rigged? Just because the DNC preferred the lifelong Democrat to the lifelong independent (who could have guessed that?) doesn't mean they couldn't still have operated a fair primary.

But your facts and reasoning regretfully interrupts the circle jerk of the Bernie bros who are convinced their democratic socialist was on the brink of revolutionizing the American political system and finally delivering us to a Denmarkian utopia.

Never mind the fact that Sanders was treated much more gently by the Clinton campaign than Obama was in '08, the only salient fact is that minority voters should have yielded their preference for a man who has spent 30+ years in Washington and yet has largely failed to build any power base.

Re: Technical report on DNC hack [pdf]

#349

Post by codedokode » Fri, Dec 30, 2016, 2:57 AM UTC

wongarsu wrote: post #191

Page 5 lists a YARA signature names "PAS_TOOL_PHP_WEB_KIT" that is supposed to match some kind of payload from the attack. It looks generic but is surprisingly specific. A quick search reveals that it happens to exactly match [1] (if you fix a few obvious bugs where the github code uses $COOKIE instead of $_COOKIE, or produces base64decode instead of base64_decode. The attackers probably fixed that in production). Ap…

I would like to add some details about a username in case someone didn't understand its meaning. The github username spells like 'nullers'. 'Nulling' is a slang word meaning removing license protection from commercial web applications like CMS (and usually publishing them for everyone to use like some type of modern Robin Hood) and 'nullers' are the people who do it.

The code has a payload (probably a web shell) encrypted with a password that should be sent via a cookie or a variable in the POST request body. The encryption has some serious weaknesses.

The @masrermike's comment https://news.ycombinator.com/item?id=13281312 has a link to the tool that could be used to encrypt the payload.

In case if anyone is interested I can post a formatted code (the payload is still encrypted): http://pastebin.com/sVLsGTub

Re: Technical report on DNC hack [pdf]

#350

Post by gravypod » Fri, Dec 30, 2016, 2:57 AM UTC

avn2109 wrote: post #272

gravypod wrote: post #150

Earlier quoted context omitted.

Check out the Mooltipass it's the hardware security device I want but can't afford because of college.

Can experts weigh in on the utility of this thing? To my ignorant eyes it looks excessively complicated. To save you a search it's here: https://www.themooltipass.com/

The idea is you put your passwords into this box. This box can only be opened with a Chip&Pin card. This magic box can be backed up and restored if ever lost or stolen. The magic box is also "physically-ish" sperated from the computer. It's Impossible (TM) to compromise the security of all the passwords in the magic box. It goes something like this.

Setup goes like this:

   1. User buys device which comes with keycards.
   2. User selects pin code for their device

Usage goes like this:

   1. User attempts to login to site 
   2. Browser plugin requests login details from device
   3. User is prompted for chip & pin from the device
   4. User puts card into device and inputs pin
   5. User clicks a button physically to aprove transaction
   6. If correct data is sent to the browser for login
   7. Subsiquent chip and pin signins aren't needed for X timeout

The interaction is more 'tedious' for some people but it's not meant for the people who are concerned with typing in a 4-digit pin. It's meant for people who would otherwise have to remember 20 digit alpha-num-sym passwords for 30 different accounts for which this is much easier and safer to do. It's also something people know how to do. If you've gone to a super market you are now prompted for Chip & Pin. People are already motivated to learn how this works (want your groceries for the week? Use the chip and pin!).

On the other hand, the average person doesn't need code words to get access to a protected resource. Bar "special organizations" I'd say there are very few people who are trained natrually into the concept of passwords. It's simple but it isn't done nearly enough for everyone to understand it which is in stark contrast when compaired to using a credit card with a pin code. Also, they could use similar or even the same pin code as their bank pin if they aren't concerned about security.